# Only people with a company email can get in

> Canonical: https://teamonly.dev/company-login

Every TeamOnly app sits behind your company's Google Workspace or Microsoft 365 login. Coworkers use the account they already have. Everyone else is turned away before your app loads. You set none of it up.

## What your coworker sees

They open the link, click "Sign in with Google" or "Sign in with Microsoft", pick their work account, and they are in the app. It takes a few seconds, and next time they are already signed in.

## What an outsider sees

Someone with a personal account, a contractor on another domain, or a bot that found the link. They get as far as the sign-in screen and are turned away there, with a message like "This app is only for acme.com accounts." Your app's code never runs for them.

## Why a shared password isn't enough for a team

A password on the whole app is better than nothing. For a team, it falls apart fast.

- **It travels.** It ends up in a chat thread, a sticky note, an email to a contractor. You can't tell who has it.
- **It has no names.** Your app can't say who approved an expense if everyone logged in as the same person.
- **It doesn't leave with people.** When someone leaves the company, they still know the password until you change it and tell everyone else the new one.
- **It often costs extra.** Some hosts charge per project to add one.

## The DIY way, and where it goes wrong

You can absolutely build this yourself. Here is what it involves, so you can decide.

### Google: create an OAuth app

Make a project in Google Cloud, set up the consent screen, create credentials, add redirect addresses for every place the app lives, and keep the secret safe.

The common mistake: using the `hd` parameter and stopping there. It only hints which accounts to show. The domain must be checked on the server.

### Microsoft: register a single-tenant app

Register the app in Microsoft Entra, choose who can sign in, and handle its tokens.

The common mistake: picking "any organization" so the setup works, which lets in work accounts from every company.

### Or put Cloudflare Access in front

Cloudflare Access is free for up to 50 users. You connect your identity provider, then write policies for each app.

The common mistake: a policy that allows a bit too much, or a new app deployed without one.

**With TeamOnly:** none of the above. You confirm your company domain once. Every app you deploy is behind it from the first second, and the check runs on our side, before your app, on every visit.

## Whole company or a list of names

Each app is open to everyone at your company by default. On the Team plan you can narrow an app to a list of email addresses, like the finance team for the expense approver.

Whoever gets in, your app is told their name and email, so it knows who did what.

## When someone leaves

When their work account is turned off, they can't sign in to your apps again. Nobody has to remember to remove them from each tool.

There are no extra accounts or seats for the people who use your apps, so there is nothing else to clean up. For IT, there is more on offboarding and ownership on the [For IT page](https://teamonly.dev/for-it).

## Questions people ask

### Can I restrict Google sign-in to my company domain?

Yes, and with TeamOnly you don't set anything up. When you create your organization you confirm your email domain, for example acme.com. From then on only Google accounts on that domain can open your apps.

### Is the hd parameter enough?

No. Google's `hd` parameter only tells the sign-in page which accounts to suggest. Anyone can remove it. The domain has to be checked on the server after sign-in, using the verified token. TeamOnly does that check on every sign-in.

### What if we use Microsoft 365?

That works too. Coworkers click "Sign in with Microsoft" and use their work account. Only accounts from your organization get in.

### What happens if someone signs in with personal Gmail?

They are turned away at the sign-in screen with a short message saying the app is only for your company. Your app never loads for them.

### Can I allow just a few people?

Yes. Each app is open to the whole company or to a list of email addresses you choose. Per-app lists are part of the Team plan.

## Keep reading

- [Security details](https://teamonly.dev/security)
- [For IT](https://teamonly.dev/for-it)
- [How it works](https://teamonly.dev/how-it-works)
- [Other ways to keep an app private](https://teamonly.dev/compare)

Join the waitlist: https://teamonly.dev/waitlist